Effect of full disk on logging under FW-1 v 2.1?

[Bret Watson <lists () bwa net>]

I'm doing an audit for an organisation, and I'm about to test the effect of
filling their disk so that the firewall can't log. However, their only
firewall person is away at the moment and I don't really want to leave them
with a headache - so can anyone tell me what happens if the disk fills? I'm
not an expert in FW-1...

Does it halt? (what I would expect) or does it overwrite the current log or
does it fail-open?

TIA,

Bret Watson
Technical Incursion Countermeasures 
consulting () bwa net                      http://www.ticm.com/
ph: (+61)(08) 9454 2487(UTC+8 hrs)      fax: (+61)(08) 9429 8800

The Insider - a e'zine on Computer security
http://www.ticm.com/about/insider.html